Privacy Notice

Privacy Policy

Information on the processing of personal data pursuant to EU Regulation 2016/679 (GDPR)

Last updated: April 2026

1. Data Controller

The data controller for personal data collected through this website is GCGreen Real Estate S.r.l., registered office at Via Armistizio 13, 35142 Padova (PD), Italy, VAT IT05461070285, e-mail: info@palazzettovicosanmarco.com, tel. +39 335 844 5188 (hereinafter "Controller"). The accommodation is located at Vico San Marco, 73052 Parabita (LE), Italy.

2. Categories of data processed and purposes

—Navigation data: IP address, browser type, pages visited, access times. Processed automatically to ensure the proper functioning of the website (legal basis: legitimate interest, Art. 6(1)(f) GDPR). Retained for 30 days in system logs.
—Booking data: first name, last name, e-mail address, phone number, stay dates, selected apartment, number of guests, optional message. Collected to perform the booking contract and comply with legal obligations (legal basis: performance of a contract, Art. 6(1)(b) GDPR; legal obligation, Art. 6(1)(c) GDPR). Retained for 10 years in compliance with fiscal and accounting obligations.
—Communication data: e-mail address and content of communications sent voluntarily to the Controller. Processed to respond to enquiries (legal basis: legitimate interest, Art. 6(1)(f) GDPR). Retained for 2 years.

3. Processing methods

Data is processed using IT tools, with logic strictly related to the stated purposes and with the adoption of adequate security measures to prevent unauthorised access, loss or alteration of data. Data is not subject to automated decision-making processes or profiling.

4. Recipients of data

—Stripe, Inc. (USA) — payment processor. Payment data (card data) is transmitted directly to Stripe and is never stored on our servers. Stripe is PCI-DSS Level 1 certified. Transfer to the USA is covered by Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR.
—Neon, Inc. — cloud database provider where booking data is stored (EU servers).
—Vercel, Inc. — website hosting provider (EU servers).
—IONOS SE — e-mail service provider for booking notifications.
—Internal error monitoring system — the site uses a proprietary technical error tracking system. Data collected (error message, stack trace, page URL, browser type) is stored in the site database, accessible only to the manager, and used solely to detect and fix malfunctions. It is not shared with third parties. Legal basis: legitimate interest Art. 6(1)(f) GDPR.
—Employees and collaborators of the Controller authorised to process data.
—Public authorities, where required by law.

5. Transfers to third countries

Some technical providers (Stripe, Vercel, Neon) are based in the United States. Transfers are carried out in compliance with Chapter V of the GDPR, with adequate safeguards in place (Standard Contractual Clauses adopted by the European Commission). Upon request, the Controller can provide a copy of the applicable safeguards.

6. Rights of the data subject

—Right of access (Art. 15 GDPR): obtain confirmation of processing and a copy of the data.
—Right to rectification (Art. 16 GDPR): correct inaccurate or incomplete data.
—Right to erasure (Art. 17 GDPR): obtain deletion of data, subject to legal obligations.
—Right to restriction (Art. 18 GDPR): restrict processing in certain cases.
—Right to data portability (Art. 20 GDPR): receive data in a structured format.
—Right to object (Art. 21 GDPR): object to processing based on legitimate interest.
—To exercise your rights, contact the Controller at info@palazzettovicosanmarco.com. The Controller will respond within 30 days.
—You may lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it).

7. Cookies and tracking technologies

This website uses only technically necessary cookies required for operation (administrator session). No profiling cookies or third-party advertising cookies are used. For more information, please consult our Cookie Policy.

8. Security

The Controller adopts technical and organisational measures adequate to ensure a level of security appropriate to the risk, including: encrypted connections (HTTPS/TLS), access to data restricted to authorised staff, error monitoring through certified tools. Payments are handled entirely by Stripe (PCI-DSS Level 1 certified) and card data never passes through or is stored on our systems.

9. Changes to this policy

The Controller reserves the right to make changes to this policy, notifying users on this page with indication of the date of last update. We recommend checking this page periodically.

GCGreen Real Estate S.r.l. · P.IVA 05461070285 · Sede legale: Via Armistizio 13, 35142 Padova (PD) · Struttura: Vico San Marco, 73052 Parabita (LE) · info@palazzettovicosanmarco.com

Caricamento...

1. Data Controller

2. Categories of data processed and purposes

—Navigation data: IP address, browser type, pages visited, access times. Processed automatically to ensure the proper functioning of the website (legal basis: legitimate interest, Art. 6(1)(f) GDPR). Retained for 30 days in system logs.

—Booking data: first name, last name, e-mail address, phone number, stay dates, selected apartment, number of guests, optional message. Collected to perform the booking contract and comply with legal obligations (legal basis: performance of a contract, Art. 6(1)(b) GDPR; legal obligation, Art. 6(1)(c) GDPR). Retained for 10 years in compliance with fiscal and accounting obligations.

—Communication data: e-mail address and content of communications sent voluntarily to the Controller. Processed to respond to enquiries (legal basis: legitimate interest, Art. 6(1)(f) GDPR). Retained for 2 years.

4. Recipients of data

—Stripe, Inc. (USA) — payment processor. Payment data (card data) is transmitted directly to Stripe and is never stored on our servers. Stripe is PCI-DSS Level 1 certified. Transfer to the USA is covered by Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR.

—Neon, Inc. — cloud database provider where booking data is stored (EU servers).

—Vercel, Inc. — website hosting provider (EU servers).

—IONOS SE — e-mail service provider for booking notifications.

—Internal error monitoring system — the site uses a proprietary technical error tracking system. Data collected (error message, stack trace, page URL, browser type) is stored in the site database, accessible only to the manager, and used solely to detect and fix malfunctions. It is not shared with third parties. Legal basis: legitimate interest Art. 6(1)(f) GDPR.

—Employees and collaborators of the Controller authorised to process data.

—Public authorities, where required by law.

5. Transfers to third countries

6. Rights of the data subject

—Right of access (Art. 15 GDPR): obtain confirmation of processing and a copy of the data.

—Right to rectification (Art. 16 GDPR): correct inaccurate or incomplete data.

—Right to erasure (Art. 17 GDPR): obtain deletion of data, subject to legal obligations.

—Right to restriction (Art. 18 GDPR): restrict processing in certain cases.

—Right to data portability (Art. 20 GDPR): receive data in a structured format.

—Right to object (Art. 21 GDPR): object to processing based on legitimate interest.

—To exercise your rights, contact the Controller at info@palazzettovicosanmarco.com. The Controller will respond within 30 days.

—You may lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it).

8. Security